High severity · published Sep 2, 2026
CVE-2026-18672
RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TU
Telerik UI for ASP.NET AJAX · Progress Software
2011.2.712 before 2026.3.812 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18672
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18672
www.telerik.com
https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rie-path-traversal-cve-2026-18672
More from Telerik UI for ASP.NET AJAX
9.8
CVE-2026-6023
Deserialization of Untrusted Data Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-19219
DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13190
PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13187
DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX
8.1
CVE-2026-13186
AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP.NET AJAX